boxy-wrapper-webpack-plugin@35.5.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js

Arbitrary attacker-controlled native code execution in the importing user's environment.

remote binary download, drop, chmod, and detached execution

The main entrypoint catches and invokes _compat.js during ordinary import. That module selects a platform-specific endpoint, fetches a binary from hard-coded worker hosts or reconstructs one from DNS TXT records, drops it into a temp directory, marks it executable on Unix, and starts it through a detached shell or cmd.exe process. The benign-looking webpack wrapper does not use this functionality.

This is a concrete, automatically reachable remote native-payload execution chain unrelated to the advertised plugin. No install hook is needed because ordinary runtime import triggers it.